Malicious code in sme-scripts-shared-library-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47a07df8d1831729273ad5bbc396191492c36cbf0f4d870af35c1101579ce0c9 [email protected] executes an install/import-time dropper. index.js requires./setup at module load, which selects a...

org.webjars.npm:compression-webpack-plugin (7.1.1), org.webjars.npm:copy-webpack-plugin (>=4.3.1, <=4.6.0) +9 more potentially affected by CVE-2026-34043 via org.webjars.npm:serialize-javascript (>=1.9.1, <=6.0.2)

org.webjars.npm:serialize-javascript MAVEN version =1.9.1, =4.3.1, =5.2.0, =1.1.6, =2.3.4, =2.5.17-beta.0 Source cves: CVE-2026-34043 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15809197...

PT-2026-3410

Summary Since 2017, the default webpack plugins have passed the entire process.env to EnvironmentPlugin. This pattern exposed ALL build environment variables to client-side JavaScript bundles whenever application code or any dependency referenced process.env.VARIABLE NAME. This is not a regressio...

EUVD-2025-198960

Malicious code in @tezign/html-webpack-plugin npm...

MAL-2025-190916 Malicious code in @tezign/html-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 437929a07e5bc4e0e6dfe545fa858db027aa2ba4e6fa87701a09d5b07277b543 The package @tezign/html-webpack-plugin was found to contain malicious code...

Malicious code in @tezign/html-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 437929a07e5bc4e0e6dfe545fa858db027aa2ba4e6fa87701a09d5b07277b543 The package @tezign/html-webpack-plugin was found to contain malicious code...

EUVD-2025-177301

Malicious code in passport-selenium-terser-webpack-plugin-juno npm...

Malicious code in terser-webpack-plugin-centaurus-version-duplex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3c5c34ad44ac941803db664d6a785fac2fd342500558c1c26e98ba07c786178 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-176003

Malicious code in terser-webpack-plugin-centaurus-version-duplex npm...

EUVD-2025-177910

Malicious code in meissa-optimize-css-assets-webpack-plugin-express-lint-staged npm...

EUVD-2025-177418

Malicious code in orbit-css-minimizer-webpack-plugin-paleontology-centaurus npm...

EUVD-2025-176413

Malicious code in server-filament-framework-css-minimizer-webpack-plugin npm...

EUVD-2025-178745

Malicious code in gemini-gravity-xanadu-css-minimizer-webpack-plugin npm...

EUVD-2025-175923

Malicious code in toml-terser-webpack-plugin-process-prompts npm...

EUVD-2025-179476

Malicious code in csrf-bootes-html-webpack-plugin-ichnology npm...

EUVD-2025-179330

Malicious code in deneb-terser-webpack-plugin-lightyear-enceladus npm...

EUVD-2025-178502

Malicious code in html-webpack-plugin-wavefunction-local-ora npm...

EUVD-2025-178506

Malicious code in html-webpack-plugin-promise-meteor-dactyl npm...

EUVD-2025-175587

Malicious code in webpack-exec-adonis-terser-webpack-plugin npm...

MAL-2025-188627 Malicious code in perseus-lyra-css-minimizer-webpack-plugin-loop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f7d3d9b81812427d006a9d83aedc8ab35ae99c772c8d05c7007ddb3d17c3f8c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...